nDepth: Failed Logon

I am working on creating a custom report that looks for failed logins (that we consider more of a threat than a user fat-fingering their password), with the Status & Sub Status Codes that are now logged in Windows Vista +

To do so, I need to find the right data in the nDepth. It appears that what I want isn't really stored in LEM.

The Event ID 4625 gives a little bit more than what I want. If the username is correct... that is no concern for this report, but if someone keeps logging in with

guessed usernames
while accounts are disabled
after hours

we have a problem.

I am looking for the following failed logons:

Status and Sub Status Codes	Description (not checked against "Failure Reason:")
0xC0000064	user name does not exist
0xC0000072	account is currently disabled
0xC000006F	user tried to logon outside his day of week or time of day restrictions
0xC0000070	workstation restriction
0xC0000193	account expiration
0xC0000071	expired password
0xC0000133	clocks between DC and other computer too far out of sync
0xC0000224	user is required to change password at next logon
0xC0000225	evidently a bug in Windows and not a risk
0xc000015b	The user has not been granted the requested logon type (aka logon right) at this machine

Is there a way to retrieve this or make sure that it is logged in LEM?

Thank you

Find more posts tagged with

log_&amp_event_management_role

help

Reports

5.4

Accepted answers

All comments

FormerMember

I'm looking into this one, there's a couple of possible answers and I want to be sure we have the right one.

aca5tle

Cool, thank you

ttl

Was there an update to this? This would be very useful for many of us I'd think.

FormerMember

All,

In Logon Failure alerts, the Failure Reason does have the textual reason behind the alerts, provided directly from Windows (and mapped directly into our FailureReason field). The substatus/codes are one level deeper, I presume added to tell the difference between those things apart (would have been nicer of Windows to just make more FailureReasons rather than 3 codes deep ).

We aren't currently mapping those substatus/status codes, under the assumption that the Failure Reason DOES cover enough information, but we see the value in having additional detail. If you'd all prefer, we can add those substatuses/codes either translated or raw (or both) to ExtraneousInfo to provide that additional level of detail - it'd be an update to the connector, but we can get it done. This field is not always filled in in the Logon Failure alerts, it's up to Windows to decide when it is or not.

This page over at Ultimate Windows Security is the one that the list above came from: Windows Security Log Event ID 4625 - An account failed to log on

Let me know what you guys would prefer - raw codes, translated strings, both?

ttl

I'd prefer both -- if it were Raw, I'd have to look it up; if it were translated I might miss the fact that it's the same error as has been generated elsewhere.

mikesmith

I agree, if we have the chose I would like to see both.